ES2353888T3 - PROCEDURE FOR THE CONTROL AND EVALUATION OF THE MESSAGE TRAFFIC OF A COMMUNICATION UNIT THROUGH A FIRST NETWORK UNIT WITHIN A MOBILE PHONE SYSTEM, AS WELL AS THE CORRESPONDING COMMUNICATION UNIT AND THE FIRST NETWORK UNIT. - Google Patents

Abstract

A method for controlling and evaluating message traffic of a communication unit uses a first network unit within a mobile radio system for forwarding all the messages of the message traffic. The first network unit decides, using one or more useful information items of the communication unit, whether one or more messages are forwarded to a second network unit for processing or whether they are blocked. The first network unit is also used to determine, using one or more useful information items of the communication unit, whether the respective message of the message traffic is logged by the first network unit in a logfile.

Description

The invention has the basic task of putting more easily and efficiently dispose of control and message traffic evaluation of a unit of communication through a first network unit within A mobile phone system. This task is solved. by the following procedure corresponding to the invention:

Procedure for traffic control and evaluation of messages of a communication unit by means of a first network unit within a telephone system mobile, in which all data traffic messages are send through the first network unit, deciding the first network unit with the help of one or more usage information of the KE communication unit if one

or several messages are relayed to a second unit of network for further processing or if they are blocked and deciding the first network unit with the help of one or various information on the use of the communication unit if the corresponding message of the message traffic is protocolize through the first network unit in a file of protocols, in which the specific block of usage information (NI) in each case to an identity of user (NID), using the specific block of usage information (NI) for the control and evaluation of at least one message from unit message traffic of communication (KE), and in which the identity of

Username

(NID) to a application (AP) from the unity from

communication (KE).

Through

he process correspondent to the

invention

be controls Y evaluate from way advantageous he

Message traffic from a communication unit. With help of one or more information on the use of the corresponding communication unit, can be included

for different communication units decision rules different and individual for control and evaluation.

In addition, by the procedure corresponding to the invention is advantageously possible protocolization of the message traffic of an application of the corresponding communication unit. Since the protocolization is executed at the application level, you can be made dependent on the protocol of the included content in the different messages, that is, of the data of the message. Thus, the protocol can be registered on message data set with multimedia content, such as video sequences or voice records as a volume of data subject to costs and excluded from protocolization of messages with control information.

The invention further relates to a first unit of network for the control and evaluation of message traffic a communication unit within a system of mobile telephony, with a receiving unit, through which all messages can be received from message traffic of the communication unit, with a sending unit, through which all messages of the message traffic, and with a processing unit, by which you can decide if at least one message from Message traffic is relayed to a second unit of network, for the next processing, or it crashes on based on one or more information on the use of the unit communication and by which you can decide if at least a message of message traffic is protocolized in a data file, based on one or more information from use of the communication unit through the first unit network, associating a specific block of information of use in each case to a user identity, using the specific block of usage information for the control and evaluation of at least one message from message traffic of the communication unit, and being

associated the user identity to an application of the KE communication unit.

The invention further relates to a unit of communication in which through a first network unit message traffic is controlled and evaluated within a mobile phone system, with a receiving unit, through which all messages can be received from message traffic, and with a sending unit, through the which can send all traffic messages from posts.

3GPP document TS 32.215 version 5.4.0, edition 5 (ETSI TS 132.15) discloses a procedure for control and evaluation of the message traffic of a unit of communication through a first network unit inside of a mobile phone system.

Other improvements of the invention are described. in the subordinate claims. The invention and its improvements will be described in more detail below based on drawings. It is shown in:

figure 1 in schematic representation a configuration for the control and evaluation of a traffic of messages from a communication unit through a network unit, consisting of a group of network elements, within a system of mobile telephony, according to a first variant of the procedure corresponding to the invention as well as the corresponding modifications,

Figure 2 a sequential diagram of a possible traffic of messages for an execution example according to the Figure 1,

figure 3 in schematic representation a possible structure of a usage information that is request with two user identities,

figure 4 in schematic representation a configuration for the control and evaluation of a traffic of messages from a communication unit through a network unit consisting of a group of network elements, within a system of mobile telephony, using the IMS standard, according to another variant of the procedure corresponding to the invention, as well as the corresponding modifications,

Figure 5 a sequential diagram of a possible traffic of messages for an application example according to the figure 4,

figure 6 a possible complement to the sequential diagram for an example of execution according to figure 5, and

figure 7 a possible sequential diagram of a traffic of messages for another application example, in the that messages are associated with SIP signaling and messages with useful data, between units of communication and network unit.

1. First example of execution 1.1 Device

A first device is shown in figure 1 possible to perform the procedure corresponding to the invention. Figure 1 shows a representation Simplified of a possible network architecture. At center of figure 1 is a home network HN (HN

- Home Network) of a KE communication unit, which found in figure 1 in a visited network VN (VN - Visited Network). This case is generally known as well. like roaming. The home network HN and the visited network VN are found in an MS mobile phone system. Unit of communication KE is housed for example in a device radio according to the GSM standard (GSM - Global System for Mobile, global mobile system) or according to the UMTS standard

(UMTS - Universal Mobile Telecommunications System, system universal for mobile telecommunications). This unit of KE communication allows the sending of messages through a transmitter unit SE1, as well as the reception of messages through its receiving unit EE1. It also has the KE communication unit of a processing unit VE1, which allows you to run for example an AP application. This AP application is in particular a browser application (browser) or a Push-to-Talk application (press to talk). The receiving unit EE1, the sending unit SE1 and the processing unit VE1 are connected by an XN1 connection network, and therefore in conditions of Exchange information

The communication unit KE is connected in the network visited VN with a first NW1 network element using a First link V1. This first NW1 network element is in particular one GGSN (GGSN - Gateway GPRS Support Node, node GPRS gateway support) (GPRS - General Packet Radio System, general radio package system). This first V1 link is established with the help of the protocol with the PDP name Context Activation Procedure, protocol context activation (PDP - Packet Data Protocol, packetized data protocol), as described in 3GPP (3GPP - 3rd Generation Partnership Project, project third generation collaboration) TS 23.060 version

5.3.0 “General Packet Radio Service GPRS”, phase 2. When the structure of this first link V1 is established, it determines that this first link V1 can only be used for message exchange, as per example messages with useful data ND, between the unit of KE communication and the first NW1 network element. As data useful ND data should preferably be understood as example an image or a voice record, but none signaling information. All messages with data useful NDs that are sent through this first link V1

are automatically retransmitted by the first element NW1 network through a second V2 link to a second NW2 network element. The second NW2 network element is preferably a data gateway.

The second NW2 network element has on the one hand a fourth link V4 in a public, packet-oriented network PN (PN - Public Network), for example Internet. The net public packet-oriented PN includes for example a second network unit NE2, such as a server with video sequences On the other hand, there is also a third V3 link with a third NW3 network element, which is

find

in the net domestic HN from the unity from

communication

KE He third element from net NW3 is

preferably a data gateway.

In addition, the third NW3 network element is linked forming a network through a fifth V5 link with a bank HSS data, preferably a Home Subscriber Service (domestic subscriber service). This HSS database contains information regarding the user of the unit of KE communication. In addition, the third element is connected NW3 network through a sixth V6 link with the network Public PN packet oriented. Additionally it can be connected the second NW2 network element in the visited network VN directly with the HSS database. This is indicated. in figure 1 with a seventh link V7 drawn with line dashed

A first network unit NE1 may be composed by various NEE network elements. In figure 1 it includes the first network element NE1 the first, second and third network elements NW1, NW2, NW3. In the case that the KE communication unit is in your home network HN, the second and third elements of NW2 and NW3 network respectively in a single network element, which covers the functionalities of the second and third NW2 and NW3 network elements respectively. The first

network unit NE1 includes a transmitter unit SE2 for transmit messages and an EE2 receiving unit to receive

posts.

Further, It includes the same a unity from

processing

VE2 for he control Y evaluation from a

traffic

from data from the application AP from the unity from

KE communication. The sending unit SE2, the receiving unit EE2 and the VE2 processing unit can exchange information through an XN2 junction network. In figure 1 Each NEE network element contains its own sending unit, its own receiving unit, its own unit of Processing and its own connection network. By way of example is represented in figure 1 for the second network element NW2 the sending unit SE2, the unit EE2 receiver, VE2 processing unit and network XN2 connection.

1.2 Query message

With the help of figure 1, it will be described below more in detail the authentication of a unit of communication. This authentication is necessary for the second network element NW2 can detect if it is in reality of a communication unit that pretends to be by another or if this communication unit is authorized to exchange messages through the second element of NW2 network with the public packet-oriented PN network.

A sequential diagram of a possible message traffic necessary for the authentication In particular, the problematic of the exchange of messages between the unit of KE communication and public packet-oriented PN network.

When the KE communication unit requests messages, for example messages with useful data ND, from the public network Package-oriented PN, or want to send messages to the it sends the communication unit KE a message from AN query to the second NW2 network element. In the case of

that the HTTP (Hyper Text Transfer) protocol be used Protocol, hypertext transfer protocol), this AN query message is an HTTP-Request (request HTTP). In this query message AN is included a EA receiver address, from which they are requested and / or send useful data ND. The address of the EA receiver can be configured in the form of a URI (URI - Unique Resource Identifier, unique resource identifier). For authenticate the communication unit KE can be used a mechanism according to IETF (IETF - International Engineering Task Force, international engineering working group) RFC (RFC - Request For Comments) 3310 "Hyper Text Transfer Protocol (HTTP) Digest Authentification Using Authentification And Key Agreement (AKA) ”(implicit HTTP authentication using authentication and key agreement), see www.ietf.org. For this is inserted in the query message AN a line of information with a name "Authorization". This also includes information on the NID user identity.

1.3 User Identity

A NID user identity is a badge unambiguous of a certain communication unit, for example of the communication unit KE. Based on the line of information contained in this NID user identity, can detect the second NW2 network element in a first decision stage A1 to which network, for example the network domestic HN, the communication unit KE belongs. In addition, it is detected if the second network element NW2 has already stored one or more authentication information for the KE communication unit you are consulting. Since the second NW2 network element does not yet have any authentication information of this type, retransmitted in consequently the second network element NW2 the message of

AN query to the third NW3 network unit. Be part of that the third link V3 is secured and that no third party You have the possibility to capture, modify or read messages.

1.4 Usage information

In the next stage, consult the third element of NW3 network with a third N3 message, which includes the identity of the NID user, in the HSS database preferably The following NI usage information for the unit KE communication: -one or several second SP2 keys, which should be used

for the authentication and coding of messages for the KE communication unit by the second NW2 network element;

-a HEF challenge, which must be used for authentication by the communication unit KE; see for example IETF RFC 3310;

-one or several FW filtering instructions. Next, it is assumed that only one second key SP2 in the database DB.

1.5 Filtering instruction

These FW filtering instructions include in particular one or more of the following criteria: -one or several PEA positive receiver addresses, which

can be addressed through the communication unit KE; -one or several NEA negative receiver addresses, which cannot address the communication unit KE;

-one or several receiver addresses to be protocolized (XEA), which must be protocolized by the first network unit NE1. In figure 1 the protocolization through the second network element NW2.

With the help of these filtering instructions FW is possible to the second network element NW2 limit the access of the KE communication unit to one or several addresses

of receiver EA determined in the public network PN oriented to packages. Additionally these can also be used FW filtering instructions to communicate to the second NW2 network element that captures access to certain EA receiver addresses separately from other accesses. Since a KE communication unit can be assigned several NID user identities, can assign one or more FW filtering instructions explicitly to a specific NID user identity. Thus, in each case it is conveniently assigned a NID user identity to an AP application.

With the help of a fourth message N4 these are transmitted NI usage information from the HSS database to Third NW3 network element. The third NW3 network element Send this NI usage information below in a fifth message N5 to the second network element NW2. At if the HTTP protocol is used for this, Insert that NI usage information for the HEF challenge of the KE communication unit in an information line with the name "WWW-Authenticate" (authenticate www); see respect IETF RFC 3310 and IETF RFC 2617 “HTTP Authentification: Basic and Digest Access Authentification ” (HTTP authentication: basic access authentication and implicit). In a similar way, all the second ones are treated keys needed for coding, for authentication and for the integrity assurance. Additionally it may be contained in this fifth message N5 a response that AEH is expected based on the HEF challenge. This allows the second NW2 network element to check a AGH response sent by the KE communication unit in based on the HEF challenge regarding whether it corresponds correctly with the expected response AEH. In this case it is no longer it is necessary to retransmit this AGH response to NW3 network element to verify that it corresponds correctly.

One or more FW filtering instructions may be included in a new message body type in this fifth message N5, which for example is formed using the HTTP protocol in the form of an HTTP message. This new guy message body can be identified by a unambiguous description. This is convenient in practice, since this unequivocal description is included in the HTTP message itself in an information line with the name "Content-Type" (type of content), which For example according to the IETF RFC 2045 standard “Multiporpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies ”(extensions Multipurpose Internet Mail (MIME), part one: Format used in Internet message bodies). In this way it is possible to the second network element NW2 detect only based on this unequivocal description the HTTP message content, for example as to whether there FW filtering instructions are included.

Figure 3 shows by way of example the structure of several FW filtering instructions, contained in a message body NK. This NK message body includes in each case two lists L11, L12 and L21, L22 respectively for each user identity NID1 and NID2. The corresponding first list L11 and L21 of the corresponding user identity NID1 and NID2 respectively includes a list of addresses of XEA receiver to protocolize. The corresponding second list L12 and L22 of the corresponding user identity NID1 and NID2 respectively, indicates one or more NEA negative receiver addresses, which cannot address the communication unit KE and / or one or more PEA positive receiver addresses, which can address the communication unit KE.

After receiving the fifth message N5, deduces the second NW2 network element in a second stage A2 the second

SP2 key from the information line with a name "WWW-Authenticate". Based on the information line with the name "Content-Type" (content type) detects the second network element NW2 than in the body of the NK message One or more FW filtering instructions are included,

Y

deduces this equally. TO continuation transmit he

second

element from net NW2 East fifth message N5

modified

how sixth message N6 to the unity from

KE communication. The KE communication unit deducts then the HEF challenge from the line of information with the name "WWW-Authenticate". With the help of one or more information stored on a card SIM (SIM - Subscriber Identification Module, subscriber identification) of the KE communication unit, an appropriate first key SP1 is now calculated, which can be used to encode messages between the KE communication unit and the second NW2 network element, as well as for the authentication and assurance of the integrity. The first key SP1 and the corresponding one Second key SP2 form a pair of SCP related keys. In addition, calculate the KE communication unit with the help of the first key SP1 the AGH response to the HEF challenge.

1.6 Modified query message

In a next stage, send the communication unit KE an ANM modified query message to the second NW2 network element. In the event that for the message of modified ANM query use HTTP syntax, this modified ANM query message corresponds to a HTTP-Request This modified ANM inquiry message includes both the address of the EA receiver, from which the data must be sent to the communication unit KE useful ND, as well as a line of information with the name "Authorization". This line of

information contains, in addition to the user's identity NID, also the AGH response to the HEF challenge.

After receiving the modified ANM inquiry message, check the second NW2 network element in a third decision stage A3, based on the NID user identity contained in the information line with the name "Authorization", if the second element of NW2 network has already stored authentication information for this KE communication unit. This results now after going through the preceding stages of this example of execution. Therefore, find out the second network element NW2 of the modified ANM query message the line of information with the name "Authorization". With the help of the second key SP2 stored in the second network element NW2, it is checked in a next stage if the answer AGH to the HEF challenge is correct. In the event that the answer transmitted AGH is not correct, the message of ANM modified query using a tenth message N10. Yes this check results in a correct coincidence with the expected AEH response to the HEF challenge, then it is checked in a fourth decision stage A4 if the communication unit KE can address the address of the EA receiver contained in the inquiry message modified ANM. In the event that this address of the EA receiver matches a receiver address negative NEA, the modified query message is rejected ANM for the transmission of useful data ND. This is communicates to the communication unit KE through a tenth message N10. Alternatively it can be done, instead of checking the address of the EA receiver with help of at least one NEA negative receiver address, the check based on at least one receiver address PEA positive. In this regard it is checked whether the address of the receiver EA corresponds to a receiver address

PEA positive. If this is not the case, the ANM modified inquiry message.

1.7 Protocolization

In the event that the address of the EA receiver is addressable, it is also checked if the address of the receiver EA corresponds to an address of the receiver a XEA protocolize for which the second NW2 network element You must separately capture the data set. If this is the case, a new first block of data DS1 is placed to the influx of data in the second NW2 network element, which preferably includes at least the following data block elements: - unequivocal identity of the data block; -address of the EA receiver accessed by the unit

KE communication; -set of useful data; - number of accesses to this address of the EA receiver.

If the address of the EA receiver does not apply to no receiver address to protocolize XEA, then a new second data block DS2 is placed for the data influx, which preferably includes following elements of the data block: - unequivocal identity of the data block; -data set.

This second data block DS2 or the element of the data block with the data set indication is updated whenever between the communication unit KE and an EA receiver address are exchanged one or several messages that may include useful ND data, which according to the corresponding FW filtering instruction does not correspond to no XEA receiver address to protocolize

All first and second data blocks DS1 and DS2 are stored in a PD protocol file on a SM memory element.

It is then generated from the message of ANM modified query an eighth message N8, which retransmits to a second NW2 network unit connected to continuation or to a unit addressed by the EA receiver address. This second NE2 network unit it is in the public network PN oriented to packets. The response to this eighth message N8, made in the figure 2 as ninth message N9, is associated upon receipt by part of the second NW2 network element to the corresponding data block DS1 or DS2, with which it has already been protocolized the modified ANM inquiry message. TO continuation of it, it is retransmitted in by the second NW2 network element the ninth message N9 via a seventh message N7 to the communication unit KE.

1.8 Evaluation of the protocol file

At a later time you can retransmit the second NW2 network element the PD protocol file through an eighth V8 link via a PDN protocol message to an AWE evaluation unit, for example a position of charging This AWE evaluation unit evaluates one or several first or second data blocks DS1 and DS2 respectively of the PD protocol file, for make from it for example an invoice to KE communication unit.

In addition, one or several first or second data blocks DS1 and DS2 respectively for the data flow through the AWE evaluation unit such that from this information can be generated from control to optimize data traffic within one or several networks, such as for the home network HN.

The use of FW filtering instructions is in this advantageous context, since this enables a pricing based on the content transmitted, by example of useful data ND. So you can register separately access to a Presence-Server (server presence), filtering the Presence-Server address. It is also advantageous for the practice that charging is not depend on the transport network below, such as GPRS. The making of data blocks, such as the first data block DS1, to capture the influx of data is done only in one element network type data gateway, as in the example of execution in the second network element NW2. A network of GPRS transport below will offer possibly free of fees the link between the unit of KE communication and the first NW1 network element, which leads directly to the second network element NW2. The charging also runs in the case of the GPRS only on the second and / or third network element NW2 and NW3 respectively. The GPRS transport network must not provide due to this no charging function.

1.9 Extensions and variations

A possible extension of the execution example is describes more in detail with the help of figure 1 and the Figure 2. For this, a second is inserted first V2M modified additional link between the first element of NW1 network and the second NW2 network element in the architecture of Figure 1. This second modified V2M link enables the second NW2 network element to communicate to the first NW1 network element when it should disconnect the first link V1 between the communication unit KE and the First NW1 network element. If you have a negative result for example the authentication of the communication unit KE, then you can indicate the second network element NW2 to

first NW1 network element that disconnects the first link V1 and thereby release the busy radio resource again by this first link V1. To do this send the second NW2 network element after transmission of the tenth message N10 a twelfth message N12 to the first network element NW1, in order to request the first NW1 network element to disconnect the first link V1. The twelfth message N12 contains an unambiguous identification of the link to disconnect, such as the first link V1.

According to an extension of the corresponding procedure to the invention, it grants the first NW1 network element to the start of the configuration to a new link of communication a VID link identity. The configuration of a communication link means the establishment of one or more links between corresponding NEE network elements and the unit of KE communication, so that this KE communication unit can send one or more AN query messages to a second network unit NW2. There may be several links to communication at the same time for a KE communication unit. For example, there are at the same time for in each case three different NID user identities of a unit of KE communication in each case three different links of communication. This VID link identity identifies unequivocally a link between the first and the second NW1 and NW2 network element respectively of this new communication link With the help of the IP address (IP

- Internet Protocol, of the unit of KE communication and of this identity of the VID link, you can unequivocally identify also the link between the KE communication unit and the first NW1 network element.

The first NW1 network element transmits this identity of the VID link together with the IPA IP address of the KE communication unit in an eleventh message N11 to second network element NW2. The second NW2 network element

acknowledges receipt of the eleventh message N11 with a Fourteenth message N14. This embodiment variant is advantageous, since it requires only another signaling between the first and second network element NW1 and NW2 respectively. The unambiguous identification of this communication link is well known to the first and to the second network element NW1 and NW2. This is convenient in practice, since a KE communication unit can own several communication links with a first NW1 network element under the same IPA IP address. Yes indicates the second network element NW2 the IP address IPA and the identity of the VID link in the twelfth message N12, then detects the first NW1 network element unequivocally what communication link or link between the communication unit KE and the first element of NW1 network must be disconnected. The first NW1 network element acknowledges receipt of the twelfth message N12 through a thirteenth message N13.

Additional signage with the eleventh and Fourteenth messages N11 and N14 can also be used additionally to send a charging information GPRS to the second NW2 network element. The second element of NW2 network can add GPRS charging information to one or more data blocks DS1 and DS2 of the second NW2 network element and transmit them to the unit AWE evaluation. The AWE evaluation unit can perform the correlation of data blocks DS1 and DS2 with the GPRS transport network charging information, for example with a charging function and from this will make a billing of the link fees for the KE communication unit.

Alternatively to the use of an identity of VID link, an IPSec IIP tunnel (IPSec - Internet Protocol Security, security protocol of Internet). For example, this can be done by

use of IPSec technology, as indicated in IETF RFC 2401, “Security Architecture for the Internet- Protocol ”(security architecture for the protocol Internet). This IPSec IIP tunnel is assigned a identity. To disconnect the link between the unit KE communication and the first NW1 network element, transmits the second network element NW2 to the first network element NW1 only this identity of the IPSec IIP tunnel. This identity is unambiguously known in the first and also in the second network element NW1 and NW2 respectively. The first NW1 network element knows the IPSec IIP tunnel identity reproduction towards the corresponding link between the first NW1 network element and the communication unit KE.

For this solution it is made available in each case an IPSec tunnel between the first and second network element NW1 and NW2 respectively for each communication link of a KE communication unit. This alternative is in the convenient practice, since you don't need any additional signaling to communicate to the second element NW2 network this identity of the IPSec tunnel. The eleventh and the fourteenth message N11 and N14 respectively do not they need then.

After successfully disconnecting the first link V1 between the KE communication unit and the first network element NW1, operation that has been originated by the twelfth message N12 through the second network element NW2, sends return the first network element NW1 a message from N13 confirmation to the second NW2 network element.

2. Second example of execution 2.1 Device and structure

Another example of execution describes a alternative for the authentication and assurance of the integrity of a KE communication unit with the help of a

second network element NW2. A second NW2 network element It can be done in the form of a data gateway. In the Figure 4 represents a possible device to perform This execution example. The KE communication unit is found in a VN visited network. They can form one or multiple messages with the help of SIP syntax (SIP - Session Initiation Protocol, initiation protocol of the session); see about it IETF RFC 3261, “SIP Initiation Protocol ”(SIP initiation protocol).

The KE communication unit is connected to a first NW1 network element in the VN visited network through of a first link V1. This first link V1 is established with the help of the protocol with the name “PDP Context Activation Procedure ”(context activation protocol PDP), as described in 3GPP TS 23.06.0 version 5.3.0. This is done this first link V1 with a first PDP context. During establishment from this first link V1 it is determined that it should only be used for exchanging messages between the unit KE communication and the second NW2 network element. Everybody the messages that are sent on this first link V1 are automatically retransmitted by the first element of NW1 network through a second V2 link to a second NW2 network element. The second NW2 network element has a fourth link V4 in a public network PN oriented to packages. Additionally it has the second network element NW2 a third V3 link to a proxy (intermediary, representative) SIP PCS. This SIP PCS proxy is found then always on the same network as the first element of NW1 network, and therefore in this example of network execution Visited VN.

In addition, it is established with the help of the protocol with the name "PDP Context Activation Procedure" PDP context activation) another link with the name of fifth link V5 between the communication unit KE and the

First NW1 network element. This fifth link V5 is mainly used for exchanging SIP messages. In addition, the first NW1 network element is linked through of a sixth V6 link with the SIP PCS proxy, which additionally it maintains a seventh link V7 with the second SIP SCS proxy. Through the fifth and sixth link V5 and V6 respectively exchange only messages without useful data ND between the communication unit KE and the SIP PCS proxy. The second SIP SCS proxy is found always in the home network HN of the communication unit KE and has among others the function of a SIP registrar; see document IETF RFC 3261, "SIP Initiation Protocol" (SIP initiation protocol). The second SIP SCS proxy It has a tenth V10 link with the HSS data bank. To be able to exchange SIP messages also with one or several KE communication units in the public network PN packet-oriented, the second SIP SCS proxy is attached with a ninth V9 link with this public PN network aimed at packages.

With the help of Figure 5, they will be described in more detail messages for substitution for authentication and integrity assurance as well as the distribution of one or more keys according to this execution example. For use one or more IMS services (IMS - IP Multimedia Subsystem, IP multimedia subsystem) a unit is registered KE communication first in the IMS network. Sequence for registration is described in detail in the IETF RFC 3261 and 3GPP TS 24.229, version 5.2.0 documents, “IP Multimedia Call Control Protocol based on SIP and SDP” (multimedia call control IP protocol based on SIP and SDP). Additionally they can be found in the 3GPP document TS 24.228 “Signaling Flows for the IP Multimedia Call Control based on SIP and SDP ” signaling for IP multimedia call control based on SIP and SDP) examples of message exchange.

2.2 Query Message

The KE communication unit sends for registration firstly an AN query message with a name "Register" through the fifth and sixth link V5 and V6 respectively to the SIP PCS proxy. This one relays this AN query message to the second SIP SCS proxy in the HN home network through a second N2 message. As he query message AN as well as the second message N2 contain the identity of the NID user. The identity of NID user to use for authentication is included, as described in documents IETF RFC 3310 and IETF RFC 2617, in the corresponding message AN or N2 in a line of information with the name "Authorization" (authorization).

2.3 Usage information

Based on this NID user identity, check the second SIP SCS proxy below with the help of a third message N3 one or more usage information NI to the bank of HSS data. For what follows, we will distinguish between two second different keys SP2P and SP2N. One of the second keys will be named below second proxy key SP2P This includes at least one key to the authentication and integrity assurance, as well as for coding the link between the unit of KE communication and the SIP PCS proxy and is intended for SIP PCS proxy. The other second key will be called continued second network key SP2N. This includes the less a key to ensure integrity and for the link coding between the KE communication unit and the second NW2 network element and is intended for second network element NW2. Next it will be assumed that there is exactly a second SP2N network key and a second proxy key SP2P. After receiving the third message N3, answer the HSS database with a fourth message

N4, which contains one or more NI usage information. A

or various NI usage information include the second proxy key SP2P and the HEF challenge, which is transmitted for authentication to the KE communication unit in A later stage. The second SIP SCS proxy sends now this information of use NI in a fifth message N5 with a name "401 Unauthorized" (401 unauthorized) to the proxy SIP PCS. This fifth message N5 includes both the second SP2P proxy key as well as the HEF challenge, using both for the authentication of the communication unit KE between the KE communication unit and the second proxy SIP SCS. The second SP2P proxy key, as well as the HEF challenge, inserted according to IETF RFC 3310 documents IETF RFC 2617 on an information line with a name “WWW-Authenticate” (WWW authentication) in the fifth message N5 The SIP PCS proxy takes the password from the fifth message N5 SP2P proxy to ensure integrity and encryption and send this modified message in the form of a sixth message N6 to the communication unit KE. The unit of KE communication then generates based on the information contained in the HEF challenge a first key, which in what it will be called first proxy key SP1P, and that used to ensure integrity and coding. It also creates the communication unit KE with the first SP1P proxy key an AGH response to the HEF challenge.

2.4 Modified inquiry message

Then send the communication unit KE a ANM modified inquiry message with a name "Register" (registration) to the SIP PCS proxy. This inquiry message Modified ANM contains the AGH response to the challenge. According to IETF RFC 3310 and IETF RFC 2617 documents, contains this ANM modified inquiry message this AGH response in an information line with the name "Authorization" (authorization). It also ensures the integrity of this

ANM modified inquiry message with the help of the first SP1P proxy key generated.

The SIP PCS proxy now checks with the help of the second SP2P proxy key received from the second SIP SCS proxy if the second modified ANM message has been modified after being created by the communication unit KE. When results after checking the integrity that the integrity is in order, send the SIP PCS proxy this query message modified ANM in the form of an eighth N8 message to the second SIP SCS proxy.

The second SIP SCS proxy checks based on the AGH response to the HEF challenge if the KE communication unit You are authorized to register on the IMS network. If that the check result in the unit of KE communication is authorized, communicates the second proxy SIP SCS with the help of a ninth message N9 to the database HSS that the KE communication unit is now registered.

2.5 Other usage information

The HSS database then sends one or various additional usage information NIW via a tenth message N10 to the second SIP SCS proxy. One or more additional NIW usage information includes for example the second network key NP2N, which is used to ensure integrity and for coding for the link between the KE communication unit and the second NW2 network element. In addition, one or more are included FW filtering instructions, which the second uses NW2 network element to filter message traffic. Alternatively to the transmission of other information of use NIW through the tenth message N10, they may have been transmitted this additional usage information NIW already by one or more information of use NI with the room message N4. One or more FW filtering instructions are create according to the preceding example of execution.

At a next stage, send the second SIP SCS proxy an eleventh message N11 with the name "200 OK" to the SIP proxy PCS This eleventh N11 message includes one or more second SP2N network keys to ensure integrity and for coding, which uses the second element of NW2 network. Also, include this eleventh message N11 additional information needed by the unit KE communication to calculate a first SP1N network key. In each case a first network key SP1N and in each case a second SP2N network key form a SCP related key pair to ensure the link between the second network element NW2 and the communication unit KE.

Alternatively it can be used, instead of keys different for the corresponding link between the unit of KE communication and the second NW2 network element and between the KE communication unit and the SIP PCS proxy, a couple of SCP common keys.

2.6 User Identity

A KE communication unit can be assigned multiple NID user identities. In this regard it is convenient in practice, in an advantageous extension, assign in each case one or more keys additionally one or more respective user identities, with the that the corresponding key can be used. The second NW2 network element can allow the exchange of messages between the communication unit KE and the second NW2 network element using a certain identity of user, such as the first user identity NID1, or reject it under another identity, as per example the first user identity NID2. So is possible to create different user profiles for a unit Communication.

The SIP PCS proxy takes from the eleventh message N11 the SP2N second network key and all instructions of

FW filtering Based on the name "200 OK" of this eleventh message N11, detects the SIP PCS proxy that the Authentication has succeeded.

The SIP PCS proxy sends this eleventh message modified N11 as fourteenth message N14 to the unit of KE communication. With the help of the information contained In this fourteenth message N14, calculate the unit of KE communication then for its part a first SP1N network key to ensure integrity and for the coding. This first SP1N network key is used for the exchange of messages between the unit of KE communication and the second NW2 network element. Further, the SIP PCS proxy transfers its SP2N network key, as well as all FW filtering instructions, with the help of a twelfth message N12 to the second network element NW2, which Confirm receipt with a thirteenth message N13.

2.7 Message exchange

You can then exchange messages with each other the KE communication unit and the second network element NW2 This will be described in more detail with the help of Figure 6. The KE communication unit sends a message from AN query to the second NW2 network element. This message from AN query contains the identity of the NID user and the address of the desired receiver EA, from which they are requested useful data ND. In the case that the HTTP protocol, this AN query message is a HTTP request This AN inquiry message is guaranteed with the help of a first SP1N network key to ensure the integrity and may be encoded. The second element of NW2 network is able to decode with one of its SP2N network keys the AN query message received and from check if this AN query message has been modified after being created by the communication unit KE. He second network element NW2 then check if

you can use the NID user identity sent together with the first SP1N network key used or well with the corresponding second network key SP2N, and with this the KE communication unit is authorized to Send one or more messages.

In the event that the KE communication unit is authorized to send one or more messages, check the second NW2 network element below with the help of FW filtering instructions received from the SIP PCS proxy if The KE communication unit can be accessed under the NID user identity used by it to the EA receiver address contained in the message query AN. If this is the case, then retransmit the second network element this query message AN in form of a sixteenth message N16 to the corresponding EA receiver address. Also check the second NW2 network element if you must place one or more blocks of data for the influx of data for access to the desired EA receiver address. The placement of one or several blocks of data then correspond to the protocol as described in the execution example preceding.

In the case that the KE communication unit does not be authorized to exchange messages with the second NW2 network element under the aforementioned NID user identity

or cannot access under the aforementioned NID user identity according to one or more FW filtering instructions to the desired EA receiver address, sends back the second network element NW2 an eighteenth message N18 to the KE communication unit. This eighteenth message N18 communicates to the communication unit KE that it does not You are authorized to access the aforementioned address of EA receiver under the aforementioned NID identity.

Finally, one or more blocks of data through an eighth link V8 for evaluation to an AEW evaluation unit.

3. Third example of execution- Association of SIP signaling and messages

According to an extension of the corresponding procedure to the invention, is described in the following example of execution how one or several messages can be associated with useful data ND between a communication unit KE and a second NW2 network element with a transaction of signaling. For this, the unit of KE communication is already registered in the IMS network and with it authentication has been successfully completed and there is also the corresponding key to ensure integrity for the coding in the second NW2 network element and in the KE communication unit. With the help of figure 7, describe in more detail the message flow for this Execution example In addition to network elements known from figure 4, is introduced for this example of execution a new network element with the name of AS application server. The AS application server is in this execution example a presence server (Presence-Server).

This AS application server must inform the KE communication unit on the modification of a presence information of another communication unit, possibly the communication unit KE2. When use the SIP protocol for signaling, use in this case the application server AS a SIP message with the name "Notify". In this regard it is convenient that the SIP message with the name "Notify" contains additionally the current PI presence information. When this PI presence information is very large, it is advantageous in practice not to transmit them to

through the same link, as the other SIP messages, and with this does not overload one or more SIP proxies, as per example the SIP PCS proxy or the second SIP SCS proxy. For this is described in the document “Draft-IETS-SIP-CONTENTINDIRECT-MECH-00”, “A mechanism for content indirection in SIP-messages ”(mechanism to reference contents in SIP messages), see www.ietf.org, a possible procedure with which a communication unit is diverted to a receiver address containing one or more data useful ND. These useful data ND correspond in this example of execution to presence information PI current. For this purpose, a diversion information is included. UNI in the SIP message. This includes for example a UEA diverted receiver address, where they can find this presence information PI. further indicates the same with which protocol, for example HTTP, they have to consult this information of presence PI.

First send the AS application server with help of a first N1 message to the second SIP SCS proxy the UNI deviation information, which also indicates that PI presence information of a second unit of KE2 communication are available at an address of UEA diverted receiver. This PI presence information They are intended for the communication unit KE. The second SIP SCS proxy extends this first N1 message with a EI registration identity. EI registration identity unequivocally identifies a SIP transaction, that is, in this case the information to the communication unit KE about the presence information PI of the second KE2 communication unit. It is possible to signal this EI registration identity with the help of a line of information with the name "Media-Authorization" (media authorization) (see IETF RFC 3310) in a message. This EI registration identity informs that those messages that due to

the UNI deviation information contained in this message NI, must be exchanged between the KE communication unit and the second NW2 network element.

In the next stage, send the second SIP SCS proxy this extended message in the form of a second message N2 at SIP PCS proxy. This second message N2 includes the UNI diversion information and EI registration identity. In addition, you can set the second SIP SCS proxy also the number of accesses allowed and / or the duration allowed for access to the address of the diverted receiver UEA. In addition, the second SIP SCS proxy places a block of data DS that can be used later for control and Message traffic evaluation. This block of DS data preferably includes the following block elements of data: - message class of the AS application server, for example SIP message of type "Notify" (communicate) or

"Info" (inform); - address of the diverted receiver sent in the corresponding EI registration menu; -NID user identity.

UEA a la saje; That he has

Alternatively

may create too so he

AS application server, instead of the second SIP proxy SCS, a block of DS data and create the registration identity EI

The SIP PCS proxy retransmits the second message N2 in form of a third message N3 to the communication unit KE In parallel to this, the SIP PCS proxy transmits a fourth message N4 to the second network element NW2. This fourth message N4 communicates to the second network element NW2 which must separately capture message traffic with the KE communication unit in the event that in messages of the KE communication unit the identity is included EI registration. For this they are contained in the room

message N4 the EI registration identity and the address of the UEA diverted receiver that can be accessed through this EI registration identity. This is advantageous in the practical, since the second NW2 network element has thus the possibility of preventing messages to other addresses of receiver other than the diverted receiver address UEA with the help of this EI registration identity. In addition, it is contained in the fourth message N4 the identity of the user NID with which the KE communication unit can send messages with this EI registration identity.

In addition, this fourth message N4 may contain a repetition information that indicates how many times you can use the communication unit KE the identity of EI record. In the event that messages are lost about the link between the KE communication unit and the second NW2 network element, you can then with the help of this repetition information indicate how many times you can repeatedly send the KE communication unit this message. This allows a multiple transmission of a certain message with the same EI registration identity. However, the possibility of a unit of KE communication use the same EI registration identity for additional messages. Repetition information you can also transfer it to the second SIP SCS proxy in the second N2 message to the SIP PCS proxy.

The SIP PCS proxy and the second NW2 network element are always found in the same network, for example figure 4 in the visited network VN. Meanwhile you can find yourself in the case of "romaming" the second SIP SCS proxy in another network different from that of the communication unit, for example in Figure 4 in the home network HN. That's why he knows the SIP PCS proxy what type of link, for example affected by loss or lossless, is supported and used by the second network element NW2.

The second NW2 network element then confirms the reception of the fourth message N4 with the help of a fifth message N5. The KE communication unit confirms the reception of the third message N3 with the help of a sixth message N6. After receiving this sixth message N6, relay the SIP PCS proxy this message in the form of a seventh message N7 to the second SIP SCS proxy, which to then retransmit this seventh message N7 in form of an eighth N8 message to the AS application server. With this knows the AS application server that the unit of KE communication has received UNI forwarding information.

Then send the communication unit KE a AN query message to the second network element NW2, for request one or more useful information ND from the address of the UEA diverted receiver indicated in the third message N3. Yes the protocol is used for the query message AN HTTP, then it is an HTTP request. This includes both the address of the diverted receiver UEA and also the identity of the NID user. This user identity NID is contained in this AN query message, such as It is described in documents IETF RFC 3310 and IETF RFC 2617, in the information line with the name "Authorization". Additionally it integrates the EI registration identity in this AN query message.

This EI registration identity may be contained in a possible extension of the execution example when use the HTTP protocol for the AN query message in a new line of information to define with the name "Access Authorization".

The second NW2 network element checks based on the information received from the SIP PCS proxy if the unit of KE communication is authorized, under the identity of NID user contained in the AN query message, to access the UEA diverted receiver address indicated, indicating the identity of EI registration. After checking

that access is allowed, retransmits the second NW2 network element this AN query to the address of UEA diverted receiver. This is done in the form of a tenth message N10. It also detects the second element of network then message exchange based on this AN query message separately. To do this place the second network element a second data block DS2, which preferably includes the following block elements of data: -EI registration identity; -UEA diverted receiver address accessed by the

KE communication unit; -NID user identity; -size of all messages; -Quantity of messages that have been exchanged under the

EI registration identity.

The reply to the tenth message N10 is sent by an eleventh message N11 to the second network element NW2. This eleventh message N11 is recorded in the second block DS2 data and then retransmitted to the unit KE communication in the form of a twelfth message N12.

In the case that the KE communication unit does not is authorized to send the AN inquiry message to second NW2 network element, sends back the second NW2 network element a thirteenth message N13 to the unit KE communication. This thirteenth message N13 communicates that the AN query message has not been retransmitted. In This case does not send the tenth, eleventh and twelfth N10, N11 and N12 respectively.

3.1 Evaluations of data blocks

In a next stage you can send the second NW2 network element this second data block DS2 for its evaluation and control to an AWE evaluation unit, by example to a charging center. Additionally you can

also transmit the data block DS to the unit of AWE evaluation.

With the help of both DS and DS2 data blocks, you can correlate with each other the AWE evaluation unit now the messages with signaling information, that is, by example SIP transactions and messages between the KE communication unit and the second NW2 network element. The EI registration identity then identifies those messages generated based on a certain transaction YEP. This is advantageous in practice, since those messages between the communication unit KE and the second NW2 network element that have been activated by the SIP signaling, can be evaluated differently, by example charging, different from the remaining traffic of posts. For example, messages can be endowed with Useful ND data containing images or pages of Internet for a higher rate than those messages generated by SIP signaling. Additionally you can derive an evaluation criterion also depending on the data volume of the messages transmitted. For example, for a greater amount of data transmitted, the price per Unit of amount of data transmitted is more favorable. Together with this, an evaluation criterion can be generated in based on access to certain receiver addresses. For example, they are assigned to certain addresses of receiver call services with cost, for example check a phone number in a system Internet based telephone information. Based on this selection criteria, access to these are billed certain receiver addresses with a charge special.

Additionally, the Multiple access to a recipient address. Possibly The first access to a specific receiver address is free, while all additional access implies

costs In practice it may also be convenient to do depend on the analysis of the messages transmitted from the NID user identity transmitted. Possibly one certain NID user identity is associated with a

5 certain AP application that can be used without cost.

In addition to the evaluation of one or several blocks of data for charging purposes of a unit of communication, the AWE evaluation unit can, based on this evaluation control and / or optimize traffic

10 messages within one or more networks. For example, a receiver address of a data server that contains useful data that is often accessed and that originates a large amount of data to be transmitted can be removed by filtering. In a next stage these can be copied

15 useful data on several data servers, possibly on different networks, to better distribute the volume of data to be transmitted.

twenty

25

30

Claims (11)

one.

Procedure for the control and evaluation of message traffic of a communication unit (KE) by a first network unit (NE1) within a mobile phone system (MS), in which all Data traffic messages are sent through the first network unit (NE1), deciding on the first network unit (NE1) with help of one or more usage information (NI) of the communication unit (KE) if one or more messages are relay to a second network unit (NE2) for post processing or if they are blocked and deciding through the first network unit (NE1) with the help of one or more usage information (NI) of the communication unit (KE) if the corresponding Message traffic message is protocolized by the first network unit (NE1) in a file of protocols (PD), characterized in that the specific block of usage information (NI) in each case to an identity of user (NID), using the specific block of usage information (NI) for control and evaluation of at least one message from the message traffic of the communication unit (KE), and because the user identity (NID) is associated with a application (AP) of the communication unit (KE).

2.

 Method according to claim 1, characterized in that one or more are requested usage information (NI) of a database (HSS) that determine the control and evaluation of one or multiple messages from the unit's message traffic communication (KE).

3.

Method according to one of the claims precedents,

characterized in that in at least one information of utilization (NI) is inserted at least one of the following filtering instructions (FW): -one or several positive receiver addresses (PEA), that can be addressed to the unit of communication (KE); -one or several negative receiver addresses (NEA), that cannot be addressed to the unit of communication (KE); -one or several receiver addresses to be protocolized (XEA), which must be protocolized by the first network unit (NE1).

Four.

Method according to one of the claims precedents, characterized in that the messages to be protocolized by Message traffic is endowed with an identity of registration (NI).

5.

Method according to one of the claims precedents, characterized in that through the first network unit (NE1) the protocol file (PD) is retransmitted with help of a protocol message (PDN) to a unit of evaluation (AWE) for evaluation.

6.

 Method according to claim 5, characterized in that through the evaluation unit (AWE) protocolized messages are evaluated in the protocol file (PD) based on at least one of the following criteria:

- useful data (ND) of the message, -address of the recipient (EA) of the message; - amount of access to the recipient's address (EA); - amount of data; -messages that have been sent with a certain user identity (NID); -messages that have been sent with a certain registration identity (NI), -relation of messages with information on signaling and / or useful data (ND).

7.

Method according to one of the claims precedents, characterized in that the unit of authorization is authorized communication (KE) for message exchange, and because to provide secure message traffic one or more key pairs (SCP) are used.

8.

Method according to one of the claims precedents, characterized by the use in an architecture according to an IP multimedia subsystem and with the help of Session Initiation Protocol.

9.

Method according to one of the claims precedents, characterized in that the first network unit (NE1) is performed using a group of network elements (NEE).

10. First network unit (NE1) for control and evaluation of a message traffic of a unit of communication (KE) within a telephone system mobile (MS), in particular according to at least one of the preceding claims, with a receiving unit (EE2), through which they can receive all messages from message traffic from the communication unit (KE), with a transmitter unit (SE2), through which they can be sent in all messages of message traffic, and with a processing unit (VE2), through which it can be decided if at least one traffic message from messages are relayed to a second network unit (NE2), for processing below or if block based on one or more information from use (NI) of the communication unit (KE) and by means of which it can be decided whether at least one message of the message traffic, based on one or more usage information (NI) of the communication unit (KE), is protocolized by the first 5 network unit (NW1) in a protocol file (PD), assigning a specific block of utilization information (NI) in each case to a user identity (NID), using the specific block of utilization information (NI) for the control and 10 evaluation of at least one message of the message traffic of the communication unit (KE) and the user identity (NID) being assigned to an application (AP) of the communication unit (KE). 11. Communication unit (KE) in which by means of a The first network unit (NE1) is controlled and evaluated data traffic within a mobile telephone system (MS), in particular according to at least one of the preceding claims 1 to 9, with a receiving unit (EE1), by the one that can 20 all messages of the message traffic are received, and with a sending unit (SE1), by which all messages of the message traffic can be sent.